fix(inference): keep local Ollama validation off the host proxy

ci/source-architecture-budget.json

@@ -56,7 +56,7 @@
   },
   "allowedCycles": [],
   "maxRootFiles": {
-    "src/lib/onboard": 308,
+    "src/lib/onboard": 309,
     "src/lib/actions": 19,
     "src/lib/actions/sandbox": 183,
     "src/lib/state": 38,

docs/reference/troubleshooting.mdx

@@ -2567,6 +2567,8 @@ Changing them after onboarding requires re-running `$$nemoclaw onboard` to rebui
 
 When `HTTP_PROXY` or `HTTPS_PROXY` is set on the host, NemoClaw adds `localhost`, `127.0.0.1`, `::1`, `0.0.0.0`, the container-host aliases `host.docker.internal` and `host.containers.internal`, and the managed inference hostname `inference.local` to `NO_PROXY` for host-side subprocesses and for the env forwarded into `openshell sandbox create`.
 This keeps local Ollama health checks, model pulls, and managed inference traffic from being chained through a corporate or desktop proxy at the sandbox-create boundary, while preserving the proxy for external hosts.
+For the local provider validation probe, NemoClaw removes `HTTP_PROXY`, `HTTPS_PROXY`, and `ALL_PROXY` from the probe process and sets `NO_PROXY=*` instead.
+A host proxy therefore cannot answer for the local endpoint, including the `host.docker.internal` alias used for Windows-host Ollama.
 Inside the running sandbox, processes continue to use the OpenShell L7 proxy for `inference.local` so OpenShell's internal routing, DNS, and audit boundaries stay intact.
 
 ### Agent cannot reach a host-side HTTP service

src/lib/inference/local.ts

@@ -1619,6 +1619,7 @@ export function buildOllamaProbeOptions(allowToolsIncompatible: boolean): {
   requireChatCompletionsToolCalling: boolean;
   retryChatCompletionsToolReadiness: boolean;
 
+  pinnedAddresses: readonly string[];
   allowHostDockerInternal: boolean;
   probeFromDocker: { expectedPort: number } | null;
 } {
@@ -1628,6 +1629,7 @@ export function buildOllamaProbeOptions(allowToolsIncompatible: boolean): {
     requireChatCompletionsToolCalling: !allowToolsIncompatible,
     retryChatCompletionsToolReadiness: !allowToolsIncompatible,
 
+    pinnedAddresses: [],
     allowHostDockerInternal: windowsHostOllama,
     probeFromDocker: windowsHostOllama ? { expectedPort: OLLAMA_PORT } : null,
   };

src/lib/inference/onboard-probes.test.ts

@@ -4,9 +4,10 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { captureAuthConfigPath } from "../adapters/http/auth-config-test-helpers";
+import { buildOllamaProbeOptions, resetOllamaHostCache } from "./local";
 import {
   HARNESS_COUNTER,
   HARNESS_TMPDIR,
@@ -756,6 +757,72 @@ exit 0
     });
   });
 
+  describe("ambient proxy on the local Ollama route (#8985)", () => {
+    const proxySensitiveCurlBody = `if [ -n "$http_proxy" ] || [ -n "$HTTP_PROXY" ] || [ -n "$all_proxy" ] || [ -n "$ALL_PROXY" ]; then
+  if [ -n "$outfile" ]; then
+    printf '%s' '{"error":"proxy has no route to the requested origin"}' > "$outfile"
+  fi
+  printf '503'
+  exit 0
+fi
+if [ -n "$outfile" ]; then
+  cat <<'JSON' > "$outfile"
+{"choices":[{"message":{"content":"OK"}}]}
+JSON
+fi
+printf '200'
+exit 0
+`;
+
+    afterEach(() => {
+      vi.unstubAllEnvs();
+      resetOllamaHostCache();
+    });
+
+    it("validates loopback Ollama while the host has an HTTP proxy configured (#8985)", () => {
+      resetOllamaHostCache();
+      vi.stubEnv("http_proxy", "http://127.0.0.1:8118");
+      vi.stubEnv("HTTP_PROXY", "http://127.0.0.1:8118");
+
+      withFakeCurlProbe(
+        {
+          script: makeFakeCurlScript(proxySensitiveCurlBody),
+          dirPrefix: "nemoclaw-ollama-ambient-proxy-probe-",
+        },
+        () => {
+          const result = probeOpenAiLikeEndpoint(
+            "http://127.0.0.1:11434/v1",
+            "qwen3.5:9b",
+            "",
+            buildOllamaProbeOptions(true),
+          );
+          expect(result).toMatchObject({ ok: true });
+        },
+      );
+    });
+
+    it("reports the proxy status when the same route is probed without the preflight pin (#8985)", () => {
+      vi.stubEnv("http_proxy", "http://127.0.0.1:8118");
+      vi.stubEnv("HTTP_PROXY", "http://127.0.0.1:8118");
+
+      withFakeCurlProbe(
+        {
+          script: makeFakeCurlScript(proxySensitiveCurlBody),
+          dirPrefix: "nemoclaw-ollama-unpinned-proxy-probe-",
+        },
+        () => {
+          const result = probeOpenAiLikeEndpoint("http://127.0.0.1:11434/v1", "qwen3.5:9b", "", {
+            skipResponsesProbe: true,
+          });
+          expect(result).toMatchObject({ ok: false });
+          expect(
+            result.failures.some((failure: { httpStatus: number }) => failure.httpStatus === 503),
+          ).toBe(true);
+        },
+      );
+    });
+  });
+
   describe("retriable HTTP statuses (#2980, #3033)", () => {
     it("retries 429 (rate limit)", () => {
       expect(RETRIABLE_HTTP_PROBE_STATUSES.has(429)).toBe(true);